1. The Needle in the Haystack
Jasper Bongertz
17 June 2015

2. The Needle in the Haystack
In an incident response situation at least one Indicator of Compromise has been found already
The haystack is all of the IT infrastructure that needs to be checked:
Clients
Servers
Network
ISP uplinks
20 November 2018

3. Looking for the Needle The challenge:
The Needle in the Haystack
Looking for the Needle
The challenge:
Telling what systems have really been compromised
So how do we usually do that?
Looking at:
file systems
log files
firewall rule tables
sensor hits (IDS/IPS/NSM/AV/Sandboxes)
documentation
20 November 2018

4. The Needle in the Haystack
Looking at the network
Network forensics can be an effective way to spot potential „Needles“
No matter how good malware hides, it‘ll use the network sooner or later
„No place to hide“ if sniffing packets at the right spot
Challenges:
Sniffing packets at the „right spot“
Scanning through gazillions of packets, looking for IoCs
Bild: CDS
20 November 2018

5. Best practices Looking at Internet uplinks
The Needle in the Haystack
Best practices
Looking at Internet uplinks
Usually there are only a couple of them
Problem: undocumented/“rogue“ uplinks
Inspecting DNS
Can be stored a long time, e.g. using PassiveDNS
Finding CnC patterns:
Answers containing Loopback addresses
High amount of errors like „no such name“
Domain Generation Algorithms
Still need to sort out false positives
Bild: Generic Brochure
20 November 2018

6. Best practices Leveraging NetFlow
The Needle in the Haystack
Best practices
Leveraging NetFlow
Long term storage of metadata of communication flows
Helps tracking lateral movement of attackers and building timelines
Can also be used for event correlation
Baselining suspicious systems
Record everything it does
Using SPAN ports/TAPs
Pinpoint assets that require file system forensics
Bild: Advanced Forensics
20 November 2018

7. The Needle in the Haystack
Demo
20 November 2018

8. Thank you! Questions?
20 November 2018